Re: Hard disk file system identification

You do *not* want to mount a drive to do any imaging.  Use dd on the
raw device (preferably behind a hardware write blocker- they're cheap
enough these days.)  If it's mounted even read-only, some of the
journaling filesystems will still update the mount count (reiser and
ext3 for sure, probably true of others.)

I generally make an image to play with and an image to have in the
safe to go back to.

You can use fdisk to read the partition table and see the partition
type, but again you really never want to do this on the original
evidence- make a copy, check the MD5s of the original and the copy,
then go to work on the copy.

Paul
-------------------------------------------------------------
paul@compuwar.net

On 30 Sep 2004 11:42:58 -0000, Nick Puetz <nickpuetz@yahoo.com> wrote:
> I have received an internal hard drive that I need to image and perform some 
> analysis on; however, I don't know the file system type on the disk, there 
> for, I can not correctly mount it to the RedHat 9 machine I used to do my 
> image creation and analysis.  Is there any way that I can identify what file 
> system type is on a hard disk without jeopardizing the integrity of the hard 
> disk?  Thanks for the help.
>
> Nick

-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com